The flaw exists in MmsSmsProvider.java where a missing permission check allows an application to read sensitive information from the MMS/SMS provider. This enables local disclosure of private data without requiring elevated privileges or additional user interaction. The weakness is represented by CWE-862, reflecting an authorization failure that can lead directly to information leakage.

The vulnerability affects Android operating system installations that include the MmsSmsProvider component. All devices running affected builds of Android are potentially impacted; the reference provided points to the Android 17 security bulletin.

The CVSS score of 10 indicates the highest severity for this local privilege issue. The EPSS score of less than 1% shows a very low probability of current exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: any application running on the device can exploit the missing permission check without user interaction, highlighting the need for prompt patching of the Android platform.